JWT Auth Pro â Stateless API Authentication for Odoo
RS256 JWT + OAuth2 client_credentials, with zero server-side sessions
Give external systems (HRMS vendors, Power Platform connectors, mobile apps, partner integrations etc.) secure API access to your Odoo database â without ever handing them a real Odoo username and password, and without relying on session cookies that need to be kept alive and re-authenticated.
JWT Auth Pro implements a standard OAuth2
client_credentials grant on top of Odoo: integrators exchange a
client_id / client_secret pair for a short-lived,
RS256-signed JWT, then call your API endpoints with a
Authorization: Bearer <token> header. Every request is
authenticated independently â no session state is stored or read.
Key Features
Never share real logins
Service accounts are flagged is_service_account and are hard-blocked
from interactive login, portal access, or password authentication â even if a
password is somehow known. Partners only ever receive a client_id/secret.
Standard OAuth2 flow
A dedicated /api/auth/token endpoint implements the
client_credentials grant type, so any standard OAuth2 client
library, Postman, or Power Platform custom connector works out of the box.
Instant revocation
Every issued token is logged with a unique jti in a full audit
trail. Revoke a single token immediately via /api/auth/revoke â
no need to wait for expiry or rotate a shared secret.
Drop-in decorator
Protect any existing or new controller with a single
@jwt_authenticated decorator. It resolves the request's
environment to the correct service user, per request, with no cookies involved.
RS256, not shared secrets
Tokens are signed with an auto-generated RSA keypair (asymmetric RS256), stored
per-database in ir.config_parameter â never a shared HMAC secret
that has to be distributed to every service verifying tokens.
Optional IP allowlisting
Restrict a given api.client to specific IPs or CIDR ranges, on top
of the client_credentials check, for partners with static egress IPs.
How it works
- Create a non-interactive service user and tick Service Account (API only).
- Create an API Client record bound to that user; generate a client_secret (shown once).
- Hand the integrator only the
client_id/client_secretpair. - They call
POST /api/auth/tokento exchange credentials for a short-lived JWT. - They call your protected endpoints with
Authorization: Bearer <token>â no cookies, no CSRF tokens, no session to keep alive. - Included with testing endpoints with postman collection.
Requirements
Python packages: PyJWT, cryptography (install via pip on the Odoo server).
Compatible with Odoo 16.0.
Please log in to comment on this module